Azure SQL: How to be notified if someone exports the database?

Question

I run a system based around an Azure SQL Database.

A few different team members need to have read access to this database to perform support and management tasks.

However, I am concerned that by having access to the database, one of them may - with the best of intentions - export the database and manage the backup carelessly, resulting in a data breach.

How can I get Azure to notify me if somebody backs up the database (or downloads more than X million rows, maybe?) These people need to have database access, I would just like to know if they use it in a way that could cause a security risk for the platform.

Answer 1

You can use Extended Events for this.

To set it up on Azure you can follow this tutorial.

For your case

1. You create a session
2. You Select the rpc_completed ( docs ) event and click configure

3. In the Global Fields tab you can select the fields you want to keep track of. Ie: Username, sql_text, session_id, database_name, client_*

4. In the Filter tab you can select a filter condition. In your case row_count would be appropriate.

When malicious users are smart, and retrieve small numbers of rows and page them this will go undetected. So a second filter could be Querys without WHERE clauses or a different approach based on your case.

When extended events are setup to write to blobstorage. You would have a different process (Azure Function, Runbook, ...) that would inspect the result and alert you.

Extended events are moslty used for troubleshooting, they replace SQL profiler. So turning it on a production server may have a performance impact.